


category of personal data 





How long we keep this data 


Our lawful basis for 
processing 


Details relating to lawful basis (where applicable) 





Criminal 


lconviction/criminal 


allegation grounds 


Criminal conviction/criminal allegation grounds 
(further information) 








Supplier and contractor information including 
names, contact details, communications with 
contractors, details of contracts, tender 
information, works undertaken, items 
purchased, invoicing arrangements, VAT 
numbers and payments made, banking details, 
information about the selection of 
contractors/suppliers, including information 
about the quality and/or value of the work or 
products. 


We obtain this data from 
you; 


Wegenerate this data 
about you. 


As part of the College's normal operations and 
dealings with its suppliers and contractors. 


In the case of transaction records, six years from 
end of the financial year in which the work was 
completed. 


In the case of information about the selection of 
contractors/suppliers, including information 
about the quality and/or value of the work or 
products, we will retain this whilst you remain a 
supplier or potential future supplier to the College. 


Processing is necessary 
for performance of our 
contract with you; 


Processing is necessary 
in order to take steps at 
your request prior to 
enteringa contract; 


Processing is necessary 
for the purposes of our 
or someone else's 
legitimate interests, 
except where overridden 
by your data protection 
rights and freedoms. 


[The College has a legitimate interest in engaging 
suppliers and contractors that meet its required 
standards. 





Records relating to event and merchandise sales 
and purchases consisting of date of the order, 
details of the event/merchandise booked, sold or 
purchased, the amount due, the contact and 
payment details of the purchaser including credit 
card number/credit card security number, direct 
debit or bank transfer (account holder, number 
and sort code) information and receipts. 


We obtain this data from 
you 
Wegenerate this data 
about you 


To process payments for events and merchandise. 


Six years from end of the financial year in which the 
transaction occurred. 





Processing is necessary 
for performance of our 
contract with you; 


Processing is necessary 
in order to take steps at 
your request prior to 
enteringa contract. 





Records relating to conference bookings consisting 
of communications and inquiries, details of the 
event/conference, the amount due, the contact 
and payment details of the purchaser. 


We generate this data 
about you 


To process bookings and payments for conferences. 


In the case of inquiries, a period of 12 months after 
the date of the inquiry, or 12 months after the 
conference if later. 


In the case of transaction records, six years from 
end of the financial year in which the transaction 
occurred. 


Processing is necessary 
for performance of our 
contract with you; 


Processing is necessary 
in order to take steps at 
your request prior to 
enteringa contract. 





Title documents, transfers, leases and contracts 
which include the names of parties, signatories and 
witnesses. General correspondence relating to the 
administration and management of leases and 
tenancies. 


We obtain this data from 
you 


In order to execute and retain title documents, 
transfers, leases and contracts. 


In the case of contracts, for a period of 6 years after 
conclusion of the contract. 


In the case of title documents, transfers and leases, 
and general correspondence, unless given to the 
purchaser ofa property, they will be kept 
permanently. 


Processing is necessary 
for performance of our 
contract with you 


Processing is necessary 
in order to take steps at 
your request prior to 
enteringa contract 


Processing is necessary 
for the purposes of our 
or someone else's 
legitimate interests, 
except where overridden 
by your data protection 
rights and freedoms 


The College has a legitimate interest in entering 
contracts, leases and transfers of land, and in 
retaining records and title documents to assist 
with the management of its properties. 


The College has a legitimate interest in maintaining 
a record of its activities as part ofa long established 
university with a strong identity and history, and 
in maintaining such records for future research. 


Processing is necessary 
for archiving purposes in 
the public interest as 
permitted under the UK 
Data Protection Act 


There is a public interest in the College maintaining 
its archive of College life for future generations, 
and in the context of the College being a College of 
a long-established University with a strong identity 
and history. 


The College is required to implement appropriate 
safeguards for individuals’ rights and freedoms. 
The UK Data Protection Act provides safeguards by 
making specific provision preventing processing 
which is likely to cause substantial damage or 
substantial distress to a data subject; and/or 
which is carried out for the purposes of measures 
or decisions with respect to a particular data 
subject, unless the purposes for which the 
processing is necessary include the purposes of 
approved medical research. 


The processing meets a 
condition in Part 1 of 

Schedule 1 to the Data 
Protection Act 2018 


Where it processes such data, the College is 
required to implement appropriate safeguards for 
individuals’ rights and freedoms. The UK Data 
Protection Act provides safeguards by making 
specific provision preventing processing which is 
likely to cause substantial damage or substantial 
distress to a data subject; and/or which is carried 
out for the purposes of measures or decisions with 
respect to a particular data subject, unless the 
purposes for which the processing is necessary 
include the purposes of approved medical 
research. 





Budget documents, audit and accounting 
documents, management accounts, investment 
documents and communications relating to such 
records, all of which may include names and 
contact details of individuals responsible for or 
involved with the budgets/accounts/investments. 


We generate this data 
about you 


We obtain this data from 
you. 


Weobtain this data from 
third parties e.g. 
accountants. 


Asa normal part ofthe College's budgetary and 
accounting processes. 


Six years from end of the financial year to which 
the records relate. 


Processing is necessary 
for the purposes of our 
or someone else's 
legitimate interests, 
except where overridden 
by your data protection 
rights and freedoms 


The College has a legitimate interest in operating 
processes for budgeting, auditing, accounting and 
investment purposes. 











Bank account records, including names of payees 
and transaction details. 


We receive this data 
from a third party (the 
bank). 





In the normal course of operating the College bank 
account. 





Six years from end of the financial year to which 
the records relate. 








Processing is necessary 
for performance of our 
contract with you; 


Processing is necessary 
for the purposes of our 
or someone else's 
legitimate interests, 
except where overridden 
by your data protection 
rights and freedoms. 





The College has a legitimate interest in processing 
its own banking records for cashflow, accounting 
and audit purposes. 























Governing body and committee agenda, 
governance documents, and some legal, financial, 
buildings and architectural records are kept in the 
College archive-for further detail see the College 
archive privacy notice and accompanying 
schedule. 


We obtain this data from 
you. 


Wegenerate this data 
about you. 


To maintain a historic record of College 
administration. 


Permanently. 


Processing is necessary 
for the purposes of our 
or someone else's 
legitimate interests, 
except where overridden 
by your data protection 
rights and freedoms 


The College has a legitimate interest in maintaining 
its historic buildings. It also has a legitimate 
interest in maintaining a record of its activities as 
part of along established university with a strong 
identity and history, and in maintaining such 
records for future research. 


Processing is necessary 
for archiving purposes in 
the public interest as 
permitted under the UK 
Data Protection Act 


There is a public interest in the College maintaining 
its archive of College life for future generations, 
and in the context of the College being a College of 
a long-established University with a strong identity 
and history. 


The College is required to implement appropriate 
safeguards for individuals’ rights and freedoms. 
The UK Data Protection Act provides safeguards by 
making specific provision preventing processing 
which is likely to cause substantial damage or 
substantial distress to a data subject; and/or 
which is carried out for the purposes of measures 
or decisions with respect to a particular data 
subject, unless the purposes for which the 
processing is necessary include the purposes of 
approved medical research. 


The processing meets a 
condition in Part 1 of 

Schedule 1 to the Data 
Protection Act 2018 


Where it processes such data, the College is 
required to implement appropriate safeguards for 
individuals' rights and freedoms. The UK Data 
Protection Act provides safeguards by making 
specific provision preventing processing which is 
likely to cause substantial damage or substantial 
distress to a data subject; and/or which is carried 
out for the purposes of measures or decisions with 
respect to a particular data subject, unless the 
purposes for which the processing is necessary 
include the purposes of approved medical 
research. 











Records generated for legal or statutory 
compliance purposes that contain names and/or 
associated personal data. For example, copies of 
data supplied pursuant to requests made under 
data protection and/or freedom of information 
legislation, records made to comply with 
safeguarding, health and safety or counter- 
terrorism legislation, in connection with legal 
advice or claims, or to comply with auditors’ 
requirements. 





We generate this data 
about you. 


|We obtain this data from 
you. 


Weobtain this data from 
third parties e.g. legal 
advisors. 





So that we havea record ofinformation supplied, 
both in the interests of good administration and 
also to meet legal and regulatory requirements. 





These records will be retained for a period of 6 
years from the date generated for compliance 
purposes unless there is compelling justification 
for the data to be retained for a longer period (egin 
connection with legal advice, or in relation to 
auditing obligations). 





Processing is necessary 
for compliance with a 
legal obligation 





Substantial public 
interest under the UK 
Data Protection Act 
2018 








Where it processes special category data for these 
purposes, the College is complying with its 
obligations under legislation, the processing is 
typically necessary for the purposes of prevention 
or detection of an unlawful act, or the exercise of a 
function conferred by law. The processingis 
necessary for reasons of substantial public interest, 
namely the requirement for the College to comply 
with its statutory and legal obligations. 


The processing meets a 
condition in Part 2 of 

Schedule 1 to the Data 
Protection Act 2018 








Where it processes special category data for these 
purposes, the College is complying with its 
obligations under legislation, the processing is 
typically necessary for the purposes of prevention 
or detection of an unlawful act, or the exercise ofa 
function conferred by law. The processing is 
necessary for reasons of substantial public interest, 
namely the requirement for the College to comply 
with its statutory and legal obligations. 








